Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
26/03/2024, 11:14
Static task
static1
Behavioral task
behavioral1
Sample
df071cea2b017b1429caef1d49d93dfd.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
df071cea2b017b1429caef1d49d93dfd.exe
Resource
win10v2004-20240226-en
General
-
Target
df071cea2b017b1429caef1d49d93dfd.exe
-
Size
13.7MB
-
MD5
df071cea2b017b1429caef1d49d93dfd
-
SHA1
8abc0827c2469a356ca8a561330c59db7657c832
-
SHA256
9567c4b9f9804cac7979f1be0a96f746cf1c80d69b04542e1c05bf6be20b6736
-
SHA512
84df3a72cfea74bc54ba76b26c97c36f012e17cb545e3c0b665bbc72f73c8e5d1a8230e80f820a0484c0d96469a69ec9de198890e2e772c322bf71559a1d7f5c
-
SSDEEP
98304:ijhd88888888888888888888888888888888888888888888888888888888888k:i
Malware Config
Extracted
tofsee
176.111.174.19
lazystax.ru
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\iuqgfemf = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2564 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\iuqgfemf\ImagePath = "C:\\Windows\\SysWOW64\\iuqgfemf\\vuemuahi.exe" svchost.exe -
Deletes itself 1 IoCs
pid Process 2924 svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 2428 vuemuahi.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2428 set thread context of 2924 2428 vuemuahi.exe 41 -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2628 sc.exe 2624 sc.exe 2436 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2792 wrote to memory of 3016 2792 df071cea2b017b1429caef1d49d93dfd.exe 28 PID 2792 wrote to memory of 3016 2792 df071cea2b017b1429caef1d49d93dfd.exe 28 PID 2792 wrote to memory of 3016 2792 df071cea2b017b1429caef1d49d93dfd.exe 28 PID 2792 wrote to memory of 3016 2792 df071cea2b017b1429caef1d49d93dfd.exe 28 PID 2792 wrote to memory of 2676 2792 df071cea2b017b1429caef1d49d93dfd.exe 30 PID 2792 wrote to memory of 2676 2792 df071cea2b017b1429caef1d49d93dfd.exe 30 PID 2792 wrote to memory of 2676 2792 df071cea2b017b1429caef1d49d93dfd.exe 30 PID 2792 wrote to memory of 2676 2792 df071cea2b017b1429caef1d49d93dfd.exe 30 PID 2792 wrote to memory of 2628 2792 df071cea2b017b1429caef1d49d93dfd.exe 32 PID 2792 wrote to memory of 2628 2792 df071cea2b017b1429caef1d49d93dfd.exe 32 PID 2792 wrote to memory of 2628 2792 df071cea2b017b1429caef1d49d93dfd.exe 32 PID 2792 wrote to memory of 2628 2792 df071cea2b017b1429caef1d49d93dfd.exe 32 PID 2792 wrote to memory of 2624 2792 df071cea2b017b1429caef1d49d93dfd.exe 34 PID 2792 wrote to memory of 2624 2792 df071cea2b017b1429caef1d49d93dfd.exe 34 PID 2792 wrote to memory of 2624 2792 df071cea2b017b1429caef1d49d93dfd.exe 34 PID 2792 wrote to memory of 2624 2792 df071cea2b017b1429caef1d49d93dfd.exe 34 PID 2792 wrote to memory of 2436 2792 df071cea2b017b1429caef1d49d93dfd.exe 36 PID 2792 wrote to memory of 2436 2792 df071cea2b017b1429caef1d49d93dfd.exe 36 PID 2792 wrote to memory of 2436 2792 df071cea2b017b1429caef1d49d93dfd.exe 36 PID 2792 wrote to memory of 2436 2792 df071cea2b017b1429caef1d49d93dfd.exe 36 PID 2792 wrote to memory of 2564 2792 df071cea2b017b1429caef1d49d93dfd.exe 39 PID 2792 wrote to memory of 2564 2792 df071cea2b017b1429caef1d49d93dfd.exe 39 PID 2792 wrote to memory of 2564 2792 df071cea2b017b1429caef1d49d93dfd.exe 39 PID 2792 wrote to memory of 2564 2792 df071cea2b017b1429caef1d49d93dfd.exe 39 PID 2428 wrote to memory of 2924 2428 vuemuahi.exe 41 PID 2428 wrote to memory of 2924 2428 vuemuahi.exe 41 PID 2428 wrote to memory of 2924 2428 vuemuahi.exe 41 PID 2428 wrote to memory of 2924 2428 vuemuahi.exe 41 PID 2428 wrote to memory of 2924 2428 vuemuahi.exe 41 PID 2428 wrote to memory of 2924 2428 vuemuahi.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\df071cea2b017b1429caef1d49d93dfd.exe"C:\Users\Admin\AppData\Local\Temp\df071cea2b017b1429caef1d49d93dfd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\iuqgfemf\2⤵PID:3016
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\vuemuahi.exe" C:\Windows\SysWOW64\iuqgfemf\2⤵PID:2676
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create iuqgfemf binPath= "C:\Windows\SysWOW64\iuqgfemf\vuemuahi.exe /d\"C:\Users\Admin\AppData\Local\Temp\df071cea2b017b1429caef1d49d93dfd.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:2628
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description iuqgfemf "wifi internet conection"2⤵
- Launches sc.exe
PID:2624
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start iuqgfemf2⤵
- Launches sc.exe
PID:2436
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:2564
-
-
C:\Windows\SysWOW64\iuqgfemf\vuemuahi.exeC:\Windows\SysWOW64\iuqgfemf\vuemuahi.exe /d"C:\Users\Admin\AppData\Local\Temp\df071cea2b017b1429caef1d49d93dfd.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
PID:2924
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12.5MB
MD579cf8baf8d3873dd87d7681dbc15a4dc
SHA17947e89cfc29c25b4433f74d840d6a711bc9cff5
SHA25623a396de79aaae96182a4d95cd3d00df4d39642a6ff8f062e35d306fed060116
SHA5129584d4ffbdac9027d04f372399d035282699946bbd2df6fcbf7287d33ad0b9392c3162cfd48f4ff845df56b11de62f959f8f6bce71847fcd10d40aac7c3159a7
-
Filesize
1.0MB
MD54cff44cce4ee7ef3ba7cbb120b6418e1
SHA1b78c21d61c6b64ac3bcf1ad77cac4ce1dd564182
SHA256833efd62a13991b680f8fd0258864cb093f1d08dc9712ceaea861d3d805c59b9
SHA512280db0b6c3679305c642b9918ec1996f47a670c1e1d8f14824c7dde21e2a9b8ab1f12e9c3c87a3330093bfd9821b3c104ff3669d074e26a32b13f1f0b2a412b6